Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-14003
Publication date:
15/12/2025
The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `add_images_to_gallery_callback()` function in all versions up to, and including, 2.13.3. This makes it possible for authenticated attackers, with Author-level access and above, to add images to arbitrary Modula galleries owned by other users.
Severity CVSS v4.0: Pending analysis
Last modification:
15/12/2025

CVE-2025-12900
Publication date:
15/12/2025
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 6.5.1 via the "ConvertController::insertToNewTable" function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author level access and above, to inject global folders and reassign arbitrary media attachments to those folders under certain circumstances.
Severity CVSS v4.0: Pending analysis
Last modification:
15/12/2025

CVE-2025-65430
Publication date:
15/12/2025
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected.
Severity CVSS v4.0: Pending analysis
Last modification:
15/12/2025

CVE-2025-65781
Publication date:
15/12/2025
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Attachment upload API treats the Authorization bearer value as a userId and enters a non-terminating body-handling branch for any non-empty bearer token, enabling trivial application-layer DoS and latent identity-spoofing.
Severity CVSS v4.0: Pending analysis
Last modification:
18/12/2025

CVE-2025-65780
Publication date:
15/12/2025
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authenticated users can update their entire user document (beyond profile fields), including orgs/teams and loginDisabled, due to missing server-side authorization checks; this enables privilege escalation and unauthorized access to other teams/orgs.
Severity CVSS v4.0: Pending analysis
Last modification:
18/12/2025

CVE-2025-65779
Publication date:
15/12/2025
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Unauthenticated attackers can update a board's "sort" value (Boards.allow returns true without verifying userId), allowing arbitrary reordering of boards.
Severity CVSS v4.0: Pending analysis
Last modification:
18/12/2025

CVE-2025-65778
Publication date:
15/12/2025
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Uploaded attachments can be served with attacker-controlled Content-Type (text/html), allowing execution of attacker-supplied HTML/JS in the application's origin and enabling session/token theft and CSRF actions.
Severity CVSS v4.0: Pending analysis
Last modification:
18/12/2025

CVE-2025-65782
Publication date:
15/12/2025
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authorization flaw in card update handling allows board members (and potentially other authenticated users) to add/remove arbitrary user IDs in vote.positive / vote.negative arrays, enabling vote forgery and unauthorized voting.
Severity CVSS v4.0: Pending analysis
Last modification:
23/12/2025

CVE-2025-65431
Publication date:
15/12/2025
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead.
Severity CVSS v4.0: Pending analysis
Last modification:
23/12/2025

CVE-2025-66388
Publication date:
15/12/2025
A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without the appropriate authorization.<br /> <br /> Users are recommended to upgrade to version 3.1.4, which fixes this issue.
Severity CVSS v4.0: Pending analysis
Last modification:
16/12/2025

CVE-2025-14714
Publication date:
15/12/2025
An Authentication Bypass vulnerability existed where the application bundled an interpreter (Python) that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle<br /> <br /> <br /> <br /> <br /> By executing the bundled interpreter directly the attacker&amp;#39;s scripts run with the application&amp;#39;s TCC privileges<br /> <br /> <br /> <br /> <br /> In fixed versions parent-constraints are used to allow only the main application to launch interpreter with those permissions<br /> <br /> This issue affects LibreOffice on macOS: from 25.2 before
Severity CVSS v4.0: LOW
Last modification:
15/12/2025

CVE-2025-37732
Publication date:
15/12/2025
Improper neutralization of input during web page generation (&amp;#39;Cross-site Scripting&amp;#39;) (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package upload functionality. This issue is related to ESA-2025-17 (CVE-2025-25018) bypassing that fix to achieve HTML injection.
Severity CVSS v4.0: Pending analysis
Last modification:
18/12/2025
Subscribe to Vulnerabilities